sanitize JSON and SQL